Law / Frameworks / NIST Privacy Framework / Control-P

NIST Privacy Framework, Control-PCT.DM-P2

Data elements can be accessed for transmission or disclosure.NIST Privacy Framework, version 1.0, January 2020, CT.DM-P2

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of 29 Sep 2026.

19: laws
19: places
0: with court rulings behind them
0: not yet in force
2: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFMEASURE 2.9 The AI model is explained, validated, and documented, and AI system output is...
NIST AI RMFMEASURE 3.3 Feedback processes for end users and impacted communities to report problems and...
NIST AI 600-1GAI-RISK-04 Data Privacy
MIT mitigations3.2 Data Governance
MIT mitigations4.6 User Rights & Recourse

A law in force is unmarked; the rest wear their state: proposed

Data subject rights

19 laws, 19 places

Place	Law	What it asks, as read here
Albania	Law No. 124/2024, rights of the data subject	Provide a data subject their personal data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where technically feasible.
Andorra	LQPD, rights of the data subject	Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées	Give a data subject their personal data in a structured, commonly used, machine readable format on request, and let them transmit it to another controller without obstruction, where the processing rests on consent or a contract and is carried out by automated means.
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, rights of the data subject	Give a person their personal data in a structured, commonly used electronic format on request, and forward it to another system where the processing rests on consent or a contract.
Democratic Republic of the Congo	Digital Code, Title III, rights of the data subject	Give a data subject whose processing rests on consent or a contract and uses automated means their data in a structured, commonly used, machine-readable format on request, and transmit it directly to another controller where technically possible.
El Salvador	Ley para la Protección de Datos Personales, rights of data subjects	Give a data subject a structured, commonly used, machine readable and interoperable copy of their personal data, and transmit it to another responsible party at their request, where the processing rests on their consent and is automated.
Ethiopia	Personal Data Protection Proclamation, rights of data subjects	Give a data subject their personal data in a structured, commonly used and machine-readable format on request, free of charge and without excessive delay, and transmit it directly to another controller or processor where that is technically possible.
Kosovo	Law No. 06/L-082 on Protection of Personal Data, rights of the data subject	Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
Malaysia	Personal Data Protection Act, data portability	An app holding the personal data of an individual in Malaysia must, on a written electronic request, transmit that data to another data controller the individual chooses, where the data formats are technically compatible.
Monaco	Loi sur la Protection des Données Personnelles, droits de la personne concernée	Give a person their data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where that is technically possible.

Show the other 9 laws

Niger	Loi n° 2022-59, droits des personnes concernées	Give a person a copy of their data in a structured, commonly used, machine-readable electronic format on request, and transmit it directly to another controller where that is technically possible.
Nigeria	Nigeria Data Protection Act, 2023, rights of a data subject	Give effect to the right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects whose data is in the same set.
Panama	Ley 81 de 2019, rights of data subjects	Give a data subject a structured, commonly used, machine readable copy of their personal data on request, transferable to another responsible party, at least where they supplied the data directly, a relevant volume of automated processing is involved, or they consented or a contract requires it.
Republic of the Congo	Law No. 29-2019, rights of the data subject	Give a data subject their personal data in a structured, commonly used, machine-readable format, and transmit it directly to another controller where technically possible.
Rwanda	Law relating to the Protection of Personal Data and Privacy, rights of the data subject	On request, resend a data subject's personal data in a structured, readable format, or transmit it directly to another data controller where technically feasible.
Serbia	Law on Personal Data Protection, rights of the data subject	Give a person their previously supplied personal data in a structured, commonly used, machine-readable format on request, and let them transmit it to another controller without hindrance.
Suriname	Draft Law on the Protection of Privacy and Personal Data, rights of the data subject proposed	Where processing rests on a contract or consent and is carried out by automated means, give the data subject their personal data in a structured, commonly used, machine readable format, and transmit it directly to another controller where technically feasible.
Ukraine	Draft Law No. 8153, data subject rights proposed	Once enacted, give a data subject in Ukraine the right to receive their personal data in a portable format.
Zambia	Data Protection Act, 2021, rights of the data subject	Give a data subject their personal data in a structured, commonly used, machine readable or otherwise legible format, and transmit it directly to another controller where that is technically or otherwise feasible.

Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.